CWE-264: Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
From the CWE List. © The MITRE Corporation.
Newest
- zlib pigzRace condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a...4.4 Medium
- jig movatwitouch, movatwitouch paid +1 moreThe Content Provider in the MovatwiTouch application before 1.793 and MovatwiTouch Paid...2.6 Low
- apple mac os xThe fill_pipeinfo function in bsd/kern/sys_pipe.c in the XNU kernel in Apple Mac OS X 10.8.x...2.1 Low
- apple mac os xThe posix_spawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not prevent use of...2.1 Low
- apple mac os x, mac os x server +1 moreSMB in Apple Mac OS X before 10.8.4, when file sharing is enabled, allows remote authenticated...4.9 Medium
- tibco silver mobileThe server in TIBCO Silver Mobile 1.1.0 does not properly verify access to the administrator role...6.5 Medium
- google android, lg optimus g e973 +1 moreThe LG Hidden Menu component for Android on the LG Optimus G E973 allows physically proximate...7.2 High
- redhat livecd-toolsRed Hat livecd-tools before 13.4.4, 17.x before 17.17, 18.x before 18.16, and 19.x before 19.3,...7.2 High
- ibm sterling connectThe file-copying functionality in IBM Sterling Connect:Direct 3.8.00, 4.0.00, and 4.1.0 for UNIX...6.8 Medium
- moodleMoodle does not enforce capability requirements for reading blog comments5.0 Medium
- moodleMoodle does not consider "don't send" attributes during hub registration4.3 Medium
- moodleMoodle is vulnerable to Sensitive Information Disclosure4.0 Medium
- moodlemod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2...4.0 Medium
- siemens scalance x200-4p irt, scalance x200irt firmware, scalance x201-3p irt +4 more +6 moreA vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) ...8.0 High
- elggengine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during...4.3 Medium
- elggengine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd...6.8 Medium
- infotecs vipnet client, vipnet coordinator, vipnet personal firewall +1 more +3 moreInfotecs ViPNet Client 3.2.10 (15632) and earlier, ViPNet Coordinator 3.2.10 (15632) and earlier,...7.2 High
- bestpractical rtRequest Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict...6.8 Medium
- qemuThe qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses...6.9 Medium
- openstack devstackOpenStack devstack uses world-readable permissions for keystone.conf, which allows local users to...2.1 Low
- emc celerra control station, vnx control station +1 moreEMC VNX Control Station before 7.1.70.2 and Celerra Control Station before 6.0.70.1 have an...6.8 Medium
- mozilla firefoxThe Mozilla Updater in Mozilla Firefox before 21.0 on Windows does not properly maintain Mozilla...6.9 Medium
- mozilla firefox, thunderbird, thunderbird esr +2 moreThe Mozilla Maintenance Service in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6,...6.9 Medium
- mozilla firefox, thunderbird, thunderbird esr +2 moreThe Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x...4.3 Medium
- microsoft windows essentialsWriter in Microsoft Windows Essentials 2011 and 2012 allows remote attackers to bypass proxy...6.8 Medium
- xenqemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the...3.3 Low
- fedoraproject 389 directory serverThe do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11...2.6 Low
- xenXen 4.0.x and 4.1.x incorrectly releases a grant reference when releasing a non-v1, non...6.9 Medium
- cisco unified customer voice portalCisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to...7.8 High
- invensys wonderware information serverInvensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not...9.3 High
- gwos groundwork monitorhtml/System-NeDi.php in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote...6.5 Medium
- gwos groundwork monitorcgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6...7.5 High
- gwos groundwork monitorThe Profile Importer feature in monarch.cgi in the MONARCH component in GroundWork Monitor...3.5 Low
- gwos groundwork monitorThe Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios...7.5 High
- gwos groundwork monitorGroundWork Monitor Enterprise 6.7.0 performs authentication on the basis of the HTTP Referer...7.5 High
- emc rsa archer egrc, rsa archer smartsuite +1 moreEMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote...4.0 Medium
- emc rsa archer egrc, rsa archer smartsuite +1 moreEMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote...4.0 Medium
- joomla joomla\!Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass...4.0 Medium
- joomla joomla\!Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass...4.0 Medium
- emc networkerThe nsrpush process in the client in EMC NetWorker before 7.6.5.3 and 8.x before 8.0.1.4 sets...7.2 High
- ruby-lang rubyThe safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the...4.3 Medium
- vmware vcenter server applianceVMware vCenter Server 5.1 before Update 1, when anonymous LDAP binding for Active Directory is...4.3 Medium
- vmware vcenter server applianceVMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to...9.0 High
- sap production planning and controlThe CP_RC_TRANSACTION_CALL_BY_SET function in the Engineering Workbench component in SAP...6.5 Medium
- sap erp central component, healthcare industry solution +1 moreThe ISHMED-PATRED_TRANSACT_RFCCALL function in the IS-H Industry-Specific Component Hospital...6.5 Medium
- ibm lotus notesIBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 does not block...5.8 Medium
- linux kernelThe scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect...6.9 Medium
- linux kernelkernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability...3.7 Low
- ruby-lang rubyRuby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068...5.0 Medium
- ruby-lang rubyRuby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent...5.0 Medium
- Show moreLoading…